Decrypt a secret
POST /decrypt
POST
/decrypt
Decrypts an age-encrypted secret using the server’s private key. Only available on port 6021 — never exposed publicly.
The CLI uses this for holden vars get --show-secrets.
Request Body required
Section titled “Request Body required ”Base64-encoded age ciphertext (armor headers stripped)
string
Example
YWdlLWVuY3J5cHRpb24ub3Jn...Responses
Section titled “ Responses ”Decrypted secret value
string
Missing ciphertext
Decryption failed